Executive brief
The Flight PHP framework contains a vulnerability where it incorrectly processes web requests by allowing them to be 'redefined' as different actions (like changing a view request into a delete request). This could allow an attacker to perform destructive actions on a website, such as deleting data, by tricking a user's browser or bypassing security filters. This impact can lead to unauthorized data modification and potential service disruption.
Technical details
The `Request::getMethod()` function in `flight/net/Request.php` unconditionally honors the `X-HTTP-Method-Override` header and the `$_REQUEST['_method']` parameter. Because `$_REQUEST` can include parameters from GET requests, an attacker can trigger unsafe HTTP methods (PUT, DELETE, PATCH) using a simple GET request. This facilitates Cross-Site Request Forgery (CSRF) without requiring JavaScript, as a simple `<img>` tag can trigger a destructive action. Additionally, this behavior can be used to bypass middleware that only inspects unsafe verbs or to cause CDN cache poisoning. The issue is fixed in version 3.18.1 by introducing the `flight.allow_method_override` setting, which is disabled by default.
Affected products
- flightphp core < 3.18.1
Timeline
- 2026-04-29: disclosed: Initial disclosure to flightphp/core
- 2026-05-06: advisory: GitHub Advisory published
- 2026-05-13: other: NVD publication date